Security and resilience
Security and resilience are operating requirements
METBooker holds information that automotive businesses need throughout the day. The platform is designed so authorised people can use that information, inappropriate access is constrained, customers can retrieve their records, and recovery is planned before an incident occurs.
Secure by default
Security is designed into identity, storage, public booking flows and operational access. It is not treated as a badge added after the platform is built.
Encryption applies to selected personal fields, not to every piece of data. We describe the controls that exist today rather than a blanket promise.
- Tenant separation
- Each business’s records are kept apart, and database security rules check who is asking before anything is read or written.
- Role-based access
- Distinct administrative, operational and read/export permissions, enforced on the server as well as in the screen.
- Multi-factor authentication
- Password-based administrative accounts need a code from an authenticator app.
- Identity sign-in
- Google and Microsoft sign-in where supported.
- Field encryption
- AES-256-GCM encryption for selected personal fields, such as customer names, contact details, addresses and vehicle registrations, before they are stored.
- Managed encryption key
- The key that encrypts those selected personal fields is managed separately from tenant data.
- Public booking routes
- Protective controls including authentication, rate controls, transactional slot locks and expiring or guarded links where applicable.
Access that follows responsibility
A system is not useful if legitimate staff cannot reach the information they need, and it is not responsible if everyone can reach everything. METBooker uses roles and server-side rules to separate full administration, operational work and read/export access. Sensitive changes and payment events have additional recording controls.
| Role | Can do | Cannot do |
|---|---|---|
| Super Admin | Everything, including settings, services, staff, billing, access and full data export | Run targeted erasure for one person; that is assisted by METBooker |
| Staff | Create, move and cancel bookings; take payments and refunds; issue credit notes | Change settings, services, staff, the website or billing |
| Accountant | Read bookings, payments and invoices; run bookkeeping exports | Change anything |
Customer control and privacy operations
The business owns its records and can take them away. A Super Admin can download a full tenant data export at any time, with credentials and secrets excluded. Before an account is deleted, an export is offered, and a final export process applies where the subscription agreement provides for it.
Requests from an individual are handled with METBooker’s help. Targeted subject access search, export and erasure are currently carried out by METBooker platform administrators on the business’s behalf; they are not self-service garage-admin controls. Where the documented erasure workflow supports it, the person receives a Certificate of Erasure. Retention and anonymisation processes remove or anonymise personal details over time, as set out in the data processing agreement.
- Privacy notice
- For people who book
- Data processing agreement and sub-processors
- For subscribing businesses
- Service terms
- Subscription agreement
- Website and platform terms
- Terms and conditions
Recoverability and business continuity
Business continuity and disaster recovery are considered throughout the way METBooker is designed and operated. Layered safeguards, monitored backups and established recovery processes help protect the booking, customer, payment and settings data your business relies on.
Those arrangements are reviewed and strengthened as the platform develops, so resilience grows with the service. Customers can also export their information, supporting their own continuity planning and keeping control of important business records in their hands.
Integrity and traceability
Selected actions are recorded, so an owner can see what changed and who changed it. METBooker does not claim that every read, click or change is audited.
- Audit records
- Selected operational and configuration activity, such as booking, payment and refund actions.
- Payment events
- Append-only payment-event history and webhook deduplication/idempotency controls.
- Configuration history
- Each saved settings version with who changed it and when, and the option to restore it.
- SERMI records
- Tamper-evident: fingerprinted and chained to the record before, with controlled void-and-replace handling. SERMI records
Undo a bad change
A wrong price or opening hour should not need re-entering from memory. Settings are saved as versions, each with the person and time, and an earlier version can be restored.
Engineering ownership
Security and resilience are led by Michael Simpson, METBooker's founder. His career spans nearly three decades, beginning in Royal Signals information systems and continuing in civilian roles with software vendors across technical security, sensitive government and blue-light environments, routing and dispatch and enterprise cybersecurity. This includes more than 20 years working with mission-critical systems. Architecture, procedures and claims are reviewed as the platform changes. The aim is not to say that incidents are impossible. It is to reduce avoidable risk, detect problems, protect recovery options and communicate honestly about scope.
Michael Simpson's full profileCommon questions
Where is METBooker data hosted?
The application database is hosted by Google Cloud in London (the europe-west2 region). Payment providers, email services and other sub-processors handle the data they need under their own terms, listed in the data processing agreement.
Does METBooker store card details?
No. Card details are entered on the payment provider’s own checkout or card reader and do not pass through METBooker. METBooker records the payment status, amounts and the provider’s reference against the booking.
Can we export our data?
Yes. A Super Admin can download a full export of the business’s records at any time, and an export is offered before an account is closed. Bookkeeping exports are also available to the Super Admin and Accountant roles.
How is staff access controlled?
Each person has a role. Super Admin covers full administration, Staff covers day-to-day bookings and payments, and Accountant can read and export without changing anything. Server-side rules enforce those roles, and password sign-ins need an authenticator code.
What happens if service recovery is needed?
Recovery follows documented procedures that use the database backup layers: point-in-time protection where configured, scheduled Firestore exports and off-site copies. Files in Cloud Storage, such as SERMI photos, website and branding assets and stored agreement PDFs, are outside the scheduled off-site backup. Exact recovery times will be published only when repeatable evidence supports them.
Can METBooker support a subject access or deletion request?
Yes, as an assisted workflow. A business can export its own data, while targeted search, export and erasure for one person are carried out by METBooker platform administrators on request, with a Certificate of Erasure where the documented workflow supports it.
- Platform, security and resilience
- Review responsibility: Michael Simpson, Founder
Spotted something wrong? Email admin@metbooker.com and we will correct it.
Where next
See how these controls sit behind the everyday workflow, then book a demo.